Ad Account Suspended: Incident Response Checklist

Direct answer

Treat a suspension or restriction as a visible state, not a confirmed cause. In the first-hour phase, freeze unsafe changes, capture the exact notice and scope, classify enforcement versus payment, verification, security, outage, or linked-container cascade, and preserve independent evidence. Use the current first-party route for the account and region, reconcile billing and measurement as separate ledgers, and call the account recovered only after access, ownership, persistence, dependencies, finance, and a monitored test pass. Provider review and recovery remain provider-dependent. Synthesis/inference from incident-response, evidence-preservation, monitoring, and platform-state sources. [RS-S03][RS-S09][DRS-A01][PR-P10][PR-P13]

Who this is for

Fit: operators, finance owners, security leads, agencies, and executives responsible for high-spend Meta, Google Ads, TikTok, or multi-platform programs when an account is suspended, restricted, read-only, unable to deliver, or under a payment/verification hold. It also fits a near miss involving an unauthorized change or linked-container event.

Non-fit: anyone seeking a shortcut around enforcement, a replacement account, identity/payment rotation, forged documents, cloaking, credential sharing, or guaranteed reinstatement. This is not a substitute for current platform instructions, legal counsel, an insurer/broker, bank-fraud handling, or digital forensics. Synthesis/inference: each outside party retains its own decision authority. [PR-P07][DRS-A03]

Decision model

A suspension label can coexist with a payment lock, verification request, compromised session, parent-container action, outage, or measurement failure. Synthesis/inference: classify the visible state first and keep competing hypotheses open. Provider and user signals can disagree; a green status page is not proof that an account-specific problem is absent. [RS-S19][PR-P01][PR-P09]

Diagnostic or control sequence

This is a first-hour-to-recovery operating path, not a provider timetable. Every step names evidence/input, owner, action, and stop/branch condition.

1. Open the incident record. Input: exact label/raw error, platform surface, account/portfolio/manager/campaign IDs, region, legal entity, UTC first-seen time, last-known-good export, and business symptom. Owner: incident lead plus recorder. Action: write the symptom without a cause statement; preserve notice URL, request ID, and case ID. Stop if the message came from an inbound “support” contact; use the platform domain directly. [DRS-A01][RS-S03][DRS-A15]
2. Assign decision rights. Input: owner/admin map, partner or manager links, billing owner, security and finance contacts, and restart approver. Owner: asset owner. Action: name one incident lead, executor, recorder/communications owner, finance owner, and platform liaison. Stop if no authorized owner is reachable; record unavailable authority and perform only pre-authorized capture. [RS-S09][DRS-A03]
3. Classify and map scope. Input: notice detail, policy/billing/verification surface, parent/child links, payment state, recent changes, and delivery snapshot. Owner: incident lead with finance/security as indicated. Action: record enforcement/restriction, payment/transaction risk, verification, takeover, outage/control-plane, reporting/measurement, regional/legal, partner/API, or cascade hypotheses; note an alternative where evidence permits. Stop speculative appeals or edits if the affected object is unclear. Synthesis/inference for this combined taxonomy. [PR-P10][PR-P11][PR-P13][PR-P15]
4. Check independent signals. Input: product-scoped status/history, second administrator, UI/API comparison, known-clean device, owned delivery/event/CRM telemetry, bank/card record, and customer symptom. Owner: operations, measurement, and finance owners. Action: timestamp agreement and disagreement. Stop using a suspect endpoint if compromise or malicious extension is plausible. Keep outage, payment, policy, verification, endpoint, and measurement hypotheses open when delivery is zero but access remains. Synthesis/inference. [RS-S07][RS-S19][PR-P01][PR-P09][PR-P21][PR-P24]
5. Contain one reversible risk. Input: before-state export, change ledger, sessions/apps/tokens, payment and budget state, and rollback condition. Owner: executor; incident lead approves; security owner leads compromise actions. Action: freeze nonessential edits; pause/reduce activity only within authority when unauthorized spend, exposure, or unsafe automation is plausible; from a known-clean endpoint revoke one identified suspect session/token after preserving logs; record expected/actual read-back. Stop when read-back conflicts, a shared dependency is affected, or blast radius grows. Synthesis/inference from containment and common-mode guidance. [RS-S03][RS-S09][RS-S17][RS-S18][DRS-A01][PR-P12]
6. Prepare one factual official escalation. Input: exact label/detail ID, affected IDs, UTC chronology, owner/entity context, authentic corrective actions, exports, and case history. Owner: platform liaison with asset-owner approval. Action: navigate directly to the current first-party route shown for that account and region; separate facts from hypotheses and submit only requested authentic records. Meta, Google, and TikTok routes and labels are mutable. Stop repeated or speculative submissions. [PR-P10][PR-P11][PR-P13][PR-P15]
7. Branch billing. Input: platform invoice/balance and transaction ID, served-delivery export, bank/card transaction, authorized-user list, payment profile, and agency invoice/contract. Owner: finance. Action: (a) suspected unauthorized activity—preserve access/transaction evidence and use official platform plus issuer/bank fraud routes; (b) legitimate platform-balance disagreement—reconcile before disputing; (c) agency/reseller mismatch—separate platform charges from management fees and route contract questions to finance/counsel. Stop blanket chargeback advice. Google distinguishes unauthorized activity from reversing a legitimate balance and warns the latter can create suspension risk. Agency branch is synthesis/inference. [BC-S07][BC-S08][BC-S09]
8. Quarantine and reconcile measurement. Input: delivery export, event/pixel/CAPI arrival, consent state, analytics, CRM/backend outcome, attribution window, time zone, and freshness/version. Owner: measurement owner with finance/growth. Action: keep billed, served, platform-attributed, analytics/event, and backend-settled records separate; freeze one cohort’s scope and settlement cutoff; record latency, consent, deduplication, and backfill limits. Stop budget conclusions when reports are stale, missing, or cross-tenant; preserve the raw view/export. Synthesis/inference. [RS-S07][RS-S08][PR-P09][PR-P18]
9. Run the recovery acceptance gate. Input: provider response/restored state, access diff, dependency map, campaign/automation diff, reconciled ledgers, test event/conversion, and residual-unknown log. Owners: asset owner for access, finance for ledgers, measurement owner for telemetry, incident lead for scope. Action: confirm known-clean endpoint; review password/MFA/recovery contact; remove unauthorized persistence; validate admins, partners, apps, tokens, rules, scripts, payments, domains, catalogs, datasets, and parent/child links; compare current state to the preserved before-state; test destination and event path. Stop if any predicate is unknown or unexpected. Login, dashboard green, case response, or one active campaign is not recovery alone. Synthesis/inference. [DRS-A01][BC-S06][BC-S09]
10. Conduct a limited monitored restart. Input: signed gate, authorized budget ceiling, stop condition, independent spend/delivery/event alerts, and monitoring owner. Owner: executor; asset owner approves scope. Action: restart the smallest authorized slice needed to test spend, delivery, event arrival, destination behavior, and reporting; record actual state after each change. Stop on unexpected spend, permissions, endpoint, delivery, or event behavior. Staged restart is synthesis/inference, not a delivery or performance promise. [RS-S07][RS-S08][BC-S06]
11. Close with a postmortem and control test. Input: chronology, impact, decision context, successful/failed mitigations, residual finance/measurement gaps, case records, and signatures. Owner: incident lead and recorder. Action: run a blameless review, assign each control change an owner/date, and test the changed export, access, billing, measurement, or restart control in a safe environment/tabletop. Stop closure while material unknowns, missing evidence, or untested corrections remain. Synthesis/inference. [RS-S10][DRS-A03][RS-S09]

Evidence to preserve

Use an access-controlled evidence location, preserve before destructive changes, and log what was unavailable. Synthesis/inference from CISA/NIST preservation guidance. [DRS-A01][RS-S03]

• Exact notice/error/detail reference, URL, and UTC capture time.
• Platform surface, region, legal entity, all affected IDs, and last-known-good/current exports.
• Admin/partner/manager/app/OAuth/token/session/extension/recovery-contact and payment state.
• Recent changes with actor, object, timestamp, expected state, and actual read-back.
• Status/history link, second-admin view, UI/API comparison, clean-device result, and owned telemetry.
• Platform invoice/balance, transaction IDs, bank/card record, authorized-user list, agency invoice, and contract reference.
• Event samples, consent/schema/version, analytics, CRM/backend record, attribution window, and freshness notes.
• Case IDs, submitted chronology, provider requests/replies, collector, access controls, retention decision, and unavailable-evidence log. Minimize personal data. [DRS-A01][RS-S05]

What not to do

• Do not create replacement accounts, rotate identities/payments to evade restrictions, cloak, use anti-detect tools, or forge records. [PR-P07][PR-P10]
• Do not send passwords, MFA codes, cookies, government IDs, full payment data, browser data, scripts, or remote-control access to inbound contacts. Use first-party domains. [DRS-A15]
• Do not spam appeals, make speculative admissions, delete evidence, wipe a suspect device, or rotate a shared dependency before mapping blast radius. [DRS-A01][RS-S17]
• Do not issue an indiscriminate chargeback against a legitimate balance. [BC-S07][BC-S08]
• Do not treat MFA, a successful script run, green dashboard, or restored login as proof every asset is clean or every mutation applied. [BC-S06][RS-S04]

When to escalate

Self-service: one platform/account; clear owner; no suspected unauthorized activity; known dependencies; complete evidence; and a task limited to following current first-party instructions. Keep the incident record and acceptance gate.

Qualified specialist: material spend/customer impact crosses systems or owners; custody, billing entity, or offboarding is unclear; unauthorized access/payment activity is plausible; evidence may matter to bank, counsel, insurer, or law enforcement; a parent container may affect multiple accounts; finance and measurement disagree; or no independent acceptance test exists. Synthesis/inference, not a spend threshold or success prediction. [RS-S09][DRS-A03]

Decline/refer away: evasion, forged evidence, credential surrender, legal/insurance conclusions, unsupported loss valuation, or guaranteed platform outcome. AdsInfra cannot override platform enforcement decisions or promise reinstatement, timing, reimbursement, or performance.

FAQ

What first? Capture the exact label, IDs, UTC time, raw error, notice URL, current billing/verification/policy state, and last-known-good export before editing. Synthesis/inference. [DRS-A01][RS-S03]

Is suspension always policy enforcement? No. Payment/transaction risk, verification, unauthorized activity, parent scope, outage, or measurement failure can coexist with the symptom. The current account notice controls the branch. [PR-P10][PR-P11][PR-P13][PR-P15]

Should we open a new account? Not to bypass a restriction. Preserve the original state and use the official route; related/new accounts may also be affected by enforcement. [PR-P07][PR-P10][PR-P11]

When involve a bank or issuer? When unauthorized activity is suspected, preserve evidence and use official platform and issuer/bank fraud routes. For a legitimate balance disagreement, reconcile first. [BC-S07][BC-S08]

When is it recovered? After owner access, persistence removal, dependency checks, billing/measurement reconciliation, a test event/conversion, limited monitored restart, and signed closure. Login alone is insufficient. Synthesis/inference. [DRS-A01][BC-S06][BC-S09]

Outage or restriction? Keep both hypotheses open, compare status with an authorized second view and owned telemetry, and avoid repeated edits. Use the existing platform-outage-vs-account-specific-problem resource when applicable. Synthesis/inference. [RS-S19][PR-P01][PR-P09][PR-P21]

Source appendix

All sources were accessed 2026-07-19. Before acting, authorized owners should check the current first-party route for the affected account, product surface, and region; labels, eligibility, and timing may vary.